An Efficient Three-Party Authenticated Key Exchange Procedure Using Chebyshev Chaotic Maps with Client Anonymity

Internet of Things(IoT)applications can be found in various industry areas,including critical infrastructure and healthcare,and IoT is one of several technological developments.As a result,tens of billions or possibly hundreds of billions of devices will be linked together.These smart devices will be able to gather data,process it,and even come to decisions on their own.Security is the most essential thing in these situations.In IoT infrastructure,authenticated key exchange systems are crucial for preserving client and data privacy and guaranteeing the security of data-in-transit(e.g.,via client identification and provision of secure communication).It is still challenging to create secure,authenticated key exchange techniques.The majority of the early authenticated key agreement procedure depended on computationally expensive and resource-intensive pairing,hashing,or modular exponentiation processes.The focus of this paper is to propose an efficient three-party authenticated key exchange procedure(AKEP)using Chebyshev chaotic maps with client anonymity that solves all the problems mentioned above.The proposed three-party AKEP is protected from several attacks.The proposed three-party AKEP can be used in practice for mobile communications and pervasive computing applications,according to statistical experiments and low processing costs.To protect client identification when transferring data over an insecure public network,our three-party AKEP may also offer client anonymity.Finally,the presented procedure offers better security features than the procedures currently available in the literature.

EBAKE-SE: A novel ECC-based authenticated key exchange between industrial IoT devices using secure element

Industrial IoT(IIoT)aims to enhance services provided by various industries,such as manufacturing and product processing.IIoT suffers from various challenges,and security is one of the key challenge among those challenges.Authentication and access control are two notable challenges for any IIoT based industrial deployment.Any IoT based Industry 4.0 enterprise designs networks between hundreds of tiny devices such as sensors,actuators,fog devices and gateways.Thus,articulating a secure authentication protocol between sensing devices or a sensing device and user devices is an essential step in IoT security.In this paper,first,we present cryptanalysis for the certificate-based scheme proposed for a similar environment by Das et al.and prove that their scheme is vulnerable to various traditional attacks such as device anonymity,MITM,and DoS.We then put forward an interdevice authentication scheme using an ECC(Elliptic Curve Cryptography)that is highly secure and lightweight compared to other existing schemes for a similar environment.Furthermore,we set forth a formal security analysis using the random oracle-based ROR model and informal security analysis over the Doleve-Yao channel.In this paper,we present comparison of the proposed scheme with existing schemes based on communication cost,computation cost and security index to prove that the proposed EBAKE-SE is highly efficient,reliable,and trustworthy compared to other existing schemes for an inter-device authentication.At long last,we present an implementation for the proposed EBAKE-SE using MQTT protocol.

Provably Secure Authenticated Diffie-Hellman Key Exchange for Resource-Limited Smart Card

Authenticated Diffie-Hellman key agreement is quite popular for establishing secure session keys. As resource-limited mobile devices are becoming more popular and security threats are increasing, it is desirable to reduce computational load for these resource-limited devices while still preserving its strong security and convenience for users. In this paper, we propose a new smart-card-based user authenticated key agreement scheme which allows users to memorize passwords, reduces users' device computational load while still preserves its strong security. The proposed scheme effectively improves the computational load of modular exponentiations by 50%, and the security is formally proved.

Provable Efficient Certificateless Group Key Exchange Protocol

Certificateless public key cryptography （CL-PKC） avoids the inherent escrow of identity-based cryptography and does not require certificates to guarantee the authenticity of public keys. Based on CL-PKC, we present an efficient constant-round group key exchange protocol, which is provably secure under the intractability of computation Diffie-Hellman problem. Our protocol is a contributory key exchange with perfect forward secrecy and has only two communication rounds. So it is more efficient than other protocols. Moreover, our protocol provides a method to design efficient constant-round group key exchange protocols and most secret sharing schemes could be adopted to construct our protocol.

An Internet Key Exchange Protocol Based on Public Key Infrastructure

Internet key exchange (IKE) is an automated key exchange mechanism that is used to facilitate the transfer of IPSec security associations (SAs). Public key infrastructure (PKI) is considered as a key element for providing security to new distributed communication networks and services. In this paper, we concentrate on the properties of the protocol of Phase 1 IKE. After investigating IKE protocol and PKI technology, we combine IKE protocol and PKI and present an implementation scheme of the IKE based on PKI. Then, we give a logic analysis of the proposed protocol with the BAN-logic and discuss the security of the protocol. The result indicates that the protocol is correct and satisfies the security requirements of Internet key exchange.

Multi-Factor Password-Authenticated Key Exchange via Pythia PRF Service

Multi-factor authentication(MFA)was proposed by Pointcheval et al.[Pointcheval and Zimmer(2008)]to improve the security of single-factor(and two-factor)authentication.As the backbone of multi-factor authentication,biometric data are widely observed.Especially,how to keep the privacy of biometric at the password database without impairing efficiency is still an open question.Using the vulnerability of encryption(or hash)algorithms,the attacker can still launch offline brute-force attacks on encrypted(or hashed)biometric data.To address the potential risk of biometric disclosure at the password database,in this paper,we propose a novel efficient and secure MFA key exchange(later denoted as MFAKE)protocol leveraging the Pythia PRF service and password-to-random(or PTR)protocol.Armed with the PTR protocol,a master password pwd can be translated by the user into independent pseudorandom passwords(or rwd)for each user account with the help of device(e.g.,smart phone).Meanwhile,using the Pythia PRF service,the password database can avoid leakage of the local user’s password and biometric data.This is the first paper to achieve the password and biometric harden service simultaneously using the PTR protocol and Pythia PRF.

Provably Secure Identity-based Group Key Exchange Protocol

Group key management is one of the basic building blocks in securing group communication.A number of solutions to group key exchange have been proposed,but most of them are not scalable and,in particular,require at least 0(log n) communication rounds.We formally present a constant -round Identity-based protocol with forward secrecy for group key exchange,which is provably secure in the security model introduced by Bresson et al.Our protocol focuses on round efficiency and the number of communication round is only one greater than the lower bound presented by Becker and Wille.And,the protocol provides a batch verification technique,which simultaneously verifies the validity of messages from other group participants and greatly improves computational efficiency.Moreover,in our protocol,it is no necessary of always-online key generation center during the execution of the protocol compared to other Identity-based protocols.

Analysis and Improvement of Cross-Realm Client-to-Client Password Authenticated Key Exchange Protocols

Because cross-realm C2C-PAKE （client-to-client password authenticated key exchange） protocols can not resist some attacks, this paper writes up new attacks on two representative protocols, then designs a new cross-realm C2C-PAKE protocol with signature and optimal number of rounds for a client （only 2-rounds between a client and a server）. Finally, it is proved that the new protocol can be resistant to all known attacks through heuristic analysis and that it brings more security through the comparisons of security properties with other protocols.

Chaotic maps and biometrics-based anonymous three-party authenticated key exchange protocol without using passwords

In three-party password authenticated key exchange （AKE） protocol, since two users use their passwords to establish a secure session key over an insecure communication channel with the help of the trusted server, such a protocol may suffer the password guessing attacks and the server has to maintain the password table. To eliminate the shortages of password- based AKE protocol, very recently, according to chaotic maps, Lee et al. [2015 Nonlinear Dyn. 79 2485] proposed a first three-party-authenticated key exchange scheme without using passwords, and claimed its security by providing a well- organized BAN logic test. Unfortunately, their protocol cannot resist impersonation attack, which is demonstrated in the present paper. To overcome their security weakness, by using chaotic maps, we propose a biometrics-based anonymous three-party AKE protocol with the same advantages. Further, we use the pi calculus-based formal verification tool ProVerif to show that our AKE protocol achieves authentication, security and anonymity, and an acceptable efficiency.

CLORKE-SFS:Certificateless One-Round Key Exchange Protocol with Strong Forward Security in Limited Communication Scenarios

Certificateless one-round key exchange(CL-ORKE)protocols enable each participant to share a common key with only one round of communication which greatly saves communication cost.CLORKE protocols can be applied to scenarios with limited communication,such as space communication.Although CL-ORKE protocols have been researched for years,lots of them only consider what secrets can be compromised but ignore the time when the secrets have been corrupted.In CL-ORKE protocols,the reveal of the long-term key attacks can be divided into two different attacks according to the time of the long-term key revealed:the attack to weak Forward Security(wFS)and the attack to strong Forward Security(sFS).Many CLKE protocols did not take into account the sFS property or considered sFS as wFS.In this paper,we first propose a new security model for CL-ORKE protocols which considers the sFS property as well as the Ephemeral Key Reveal attack.Then,we give a CL-ORKE protocol which is called CLORKE-SFS.CLORKE-SFS is provably secure under the proposed model provided the Elliptic Curve Computational Diffie-Hellman(ECCDH)and the Bilinear Computational Diffie-Hellman problem(BCDH)assumption hold.The security model and the protocol may give inspiration for constructing oneround key exchange protocols with perfect forward security in certificateless scenarios.

Heuristic and Bent Key Exchange Secured Energy Efficient Data Transaction for Traffic Offloading in Mobile Cloud

In today’s world,smart phones offer various applications namely face detection,augmented-reality,image and video processing,video gaming and speech recognition.With the increasing demand for computing resources,these applications become more complicated.Cloud Computing(CC)environment provides access to unlimited resource pool with several features,including on demand self-service,elasticity,wide network access,resource pooling,low cost,and ease of use.Mobile Cloud Computing(MCC)aimed at overcoming drawbacks of smart phone devices.The task remains in combining CC technology to the mobile devices with improved battery life and therefore resulting in significant performance.For remote execution,recent studies suggested downloading all or part of mobile application from mobile device.On the other hand,in offloading process,mobile device energy consumption,Central Processing Unit(CPU)utilization,execution time,remaining battery life and amount of data transmission in network were related to one or more constraints by frameworks designed.To address the issues,a Heuristic and Bent Key Exchange(H-BKE)method can be considered by both ways to optimize energy consumption as well as to improve security during offloading.First,an energy efficient offloading model is designed using Reactive Heuristic Offloading algorithm where,the secondary users are allocated with the unused primary users’spectrum.Next,a novel AES algorithm is designed that uses a Bent function and Rijndael variant with the advantage of large block size is hard to interpret and hence is said to ensure security while accessing primary users’unused spectrum by the secondary user.Simulations are conducted for efficient offloading in mobile cloud and performance valuations are carried on the way to demonstrate that our projected technique is successful in terms of time consumption,energy consumption along with the security aspects covered during offloading in MCC.

E2E KEEP: End to End Key Exchange and Encryption Protocol for Accelerated Satellite Networks

Accelerating methods are used to enhance TCP performance over satellite links by employing Performance Enhancement Proxies (PEPs). However, providing a secure connection through the PEPs seems to be impossible. In this paper an appropriate method is proposed in order to provide an accelerated secure E2E connection. We show an efficient secure three-party protocol, based on public key infrastructure (PKI), which provides security against spiteful adversaries. Our construction is based on applying asymmetric cryptography techniques to the original IKE protocol. Security protocols use cryptography to set up private communication channels on an insecure network. Many protocols contain flaws, and because security goals are seldom specified in detail, we cannot be certain what constitute a flaw. Proofing security properties is essential for the development of secure protocol. We give a logic analysis of the proposed protocol with the BAN-logic and discuss the security of the protocol. The result indicates that the protocol is correct and satisfies the security requirements of Internet key exchange. Based on the results of this preliminary analysis, we have implemented a prototype of our security protocol and evaluated its performance and checked safety properties of security protocol, and the results show that the protocol is robust and safe against major security threats.

A Two-Party Password-Authenticated Key Exchange Protocol with Verifier

To tackle with the security lack in the password-authenticated key exchange protocol, this paper proposes a two-party password-authenticated key exchange protocol based on a verifier. In the proposed protocol, a user stores his password in plaintext, and the server stores a verifier for the user’s password, using DL difficult problem and DH difficult problem, through the session between user and server to establish a session key. The security discussion result shows that the proposed protocol provides forward secrecy, and can effectively defend against server compromising fake attacks, dictionary attacks and middleman attacks. Protocol efficiency comparisons reveal our protocol is more reasonable.

Security Analysis of Broadcaster Group Key Exchange Protocols

Group key exchange protocols are basic protocols to provide privacy and integrity in secure group communication. This paper discusses the security of one type of group key exchange protocols and defines the kind of protocols as broadcaster group protocols. It points out two attacks on this kind of protocols. The first attack can be avoided by using fresh values in each action during one session of the group protocol. The second attack should be related with concrete application. It also proposes a dynamic key agreement protocol as an example of solutions at the last part of the paper.

Scheme for Secure Communication via Information Hiding Based on Key Exchange and Decomposition Protocols

This paper considers a decomposition framework as a mechanism for information hiding for secure communication via open network channels. Two varieties of this framework are provided: one is based on Gaussian arithmetic with complex modulus and another on an elliptic curve modular equation. The proposed algorithm is illustrated in a numerical example.

An Enhanced Dragonfly Key Exchange Protocol against Offline Dictionary Attack

Dragonfly is Password Authenticated Key Exchange protocol that uses a shared session key to authenticate parties based on pre-shared secret password. It was claimed that this protocol was secure against off-line dictionary attack, but a new research has proved its vulnerability to off-line dictionary attack and proving step was applied by using “Patched Protocol” which was based on public key validation. Unfortunately, this step caused a raise in the computation cost, which made this protocol less appealing than its competitors. We proposed an alternate enhancement to keep this protocol secure without any extra computation cost that was known as “Enhanced Dragonfly”. This solution based on two-pre-shared secret passwords instead of one and the rounds between parties had compressed into two rounds instead of four. We prove that the enhanced-Dragonfly protocol is secure against off-line dictionary attacks by analyzing its security properties using the Scyther tool. A simulation was developed to measure the execution time of the enhanced protocol, which was found to be much less than the execution time of patched Dragonfly. The off-line dictionary attack time is consumed for few days if the dictionary size is 10,000. According to this, the use of the enhanced Dragonfly is more efficient than the patched Dragonfly.

ETP-AKEP: enhanced three-party authenticated key exchange protocols for data integrity in cloud environments

With key exchange protocols, a secure session key is generated between two remote users, andservers and exchanged between them. It is generally used to prevent unauthorised users fromgaining access to sensitive data. This article presents an enhanced three-party authenticated keyexchange protocols (ETP-AKE) protocol that does not depend on symmetric key encryption andinstead uses asymmetric key encryption. A key component of the proposed ETP-AKE protocol isusing elliptic curve encryption in conjunction with a one-way hash function. Its integrity certificationwas confirmed via the usage of the AVISPA tool package. Our proposed protocol is intendedto protect against various security threats, including the man-in-the-middle assault, the parallelattack, and the key-compromise attack, among others.

A Novel Approach towards Cost Effective Region-Based Group Key Agreement Protocol for Ad Hoc Networks Using Elliptic Curve Cryptography

This paper addresses an interesting security problem in wireless ad hoc networks: the dynamic group key agreement key establishment. For secure group communication in an ad hoc network, a group key shared by all group members is required. This group key should be updated when there are membership changes (when the new member joins or current member leaves) in the group. In this paper, we propose a novel, secure, scalable and efficient region-based group key agreement protocol for ad hoc networks. This is implemented by a two-level structure and a new scheme of group key update. The idea is to divide the group into subgroups, each maintaining its subgroup keys using group elliptic curve diffie-hellman (GECDH) Protocol and links with other subgroups in a tree structure using tree-based group elliptic curve diffie-hellman (TGECDH) protocol. By introducing region-based approach, messages and key updates will be limited within subgroup and outer group;hence computation load is distributed to many hosts. Both theoretical analysis and experimental results show that this Region-based key agreement protocol performs well for the key establishment problem in ad hoc network in terms of memory cost, computation cost and communication cost.

Practical Encrypted Key Agreement Using Passwords

We presented a simple and efficient password-based encrypted key exchange protocol that allows a user to establish secure session keys with remote servers from client terminals in low resource environments. He does not need to carry smart card storing his private information but just needs to know his identity and password. For this purpose, the scheme was implemented over elliptic curves because of their well-known advantages with regard to processing and size constraints. Furthermore, the scheme is provably secure under the assumptions that the hash function closely behaves like a random oracle and that the elliptic curve computational Diffie-Hellman problem is difficult.

Scalable protocol for cross-domain group password-based authenticated key exchange

Cross-domain password-based authenticated key exchange （PAKE） protocols have been studied for many years. However, these protocols are mainly focusing on multi-participant within a single domain in an open network environment. This paper proposes a novel approach for designing a cross-domain group PAKE protocol, that primarily handles with the setting of multi-participant in the multi- domain. Moreover, our protocol is proved secure against active adversary in the Real-or-Random （ROR） model. In our protocol, no interaction occurs between any two domain authentication servers. They are regarded as ephemeral certificate authorities （CAs） to certify key materials that participants might subsequently use to exchange and agree on group session key. We further justify the computational complexity and measure the average computation time of our protocol. To the best of our knowledge, this is the first work to analyze and discuss a provably secure multi-participant cross-domain group PAKE protocol.